publish-pypi.yml

name: Publish

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read

jobs:
  publish:
    name: Publish
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install build dependencies
        run: pip install build twine

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Validate version matches
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          PYPROJECT_VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")
          if [ "$VERSION" != "$PYPROJECT_VERSION" ]; then
            echo "Tag version ($VERSION) does not match pyproject.toml ($PYPROJECT_VERSION)"
            exit 1
          fi
          echo "✓ Version $VERSION matches"

      - name: Build package
        run: python -m build

      - name: Publish
        run: twine upload dist/* -u __token__ -p ${{ secrets.PYPI_API_TOKEN }}